Bypass Two-Factor Authentication in pH7 Social Dating CMS by pH7Software

CVE-2026-107638

What is CVE-2026-107638?

A critical vulnerability in the pH7Builder prior to version 18.5.0 allows attackers to exploit improper restrictions on authentication attempts. Specifically, those with knowledge of a user's password can submit an unlimited number of six-digit TOTP codes via the VerificationCodeFormProcess.php script. This flaw enables unauthorized access to user accounts, including member, affiliate, and administrator accounts, effectively allowing account takeover without adequate safeguards in place.

References